AWS cli medium security documentation change
Summary
Added documentation for new RDS disaster recovery configurations (rdsPromoteReadReplicaConfig and rdsCreateCrossRegionReadReplicaConfig) including cross-account role requirements and external ID usage. Expanded region switching guidance and added post-recovery workflow support.
Security assessment
The change introduces documentation for cross-account roles (with IAM ARN patterns) and external IDs described as 'secret keys', which are security mechanisms for secure cross-account access. This addresses secure configuration of disaster recovery features by enforcing role-based access control and external ID validation to prevent confused deputy issues.
Diff
diff --git a/cli/latest/reference/arc-region-switch/update-plan.md b/cli/latest/reference/arc-region-switch/update-plan.md index 48df8153d..00e49498c 100644 --- a//cli/latest/reference/arc-region-switch/update-plan.md +++ b//cli/latest/reference/arc-region-switch/update-plan.md @@ -15 +15 @@ - * [AWS CLI 2.33.29 Command Reference](../../index.html) » + * [AWS CLI 2.34.0 Command Reference](../../index.html) » @@ -94,0 +95 @@ See also: [AWS API Documentation](https://docs.aws.amazon.com/goto/WebAPI/arc-re + [--cli-error-format <value>] @@ -143 +144 @@ See also: [AWS API Documentation](https://docs.aws.amazon.com/goto/WebAPI/arc-re ->>>>> This is a Tagged Union structure. Only one of the following top level keys can be set: `customActionLambdaConfig`, `ec2AsgCapacityIncreaseConfig`, `executionApprovalConfig`, `arcRoutingControlConfig`, `globalAuroraConfig`, `parallelConfig`, `regionSwitchPlanConfig`, `ecsCapacityIncreaseConfig`, `eksResourceScalingConfig`, `route53HealthCheckConfig`, `documentDbConfig`. +>>>>> This is a Tagged Union structure. Only one of the following top level keys can be set: `customActionLambdaConfig`, `ec2AsgCapacityIncreaseConfig`, `executionApprovalConfig`, `arcRoutingControlConfig`, `globalAuroraConfig`, `parallelConfig`, `regionSwitchPlanConfig`, `ecsCapacityIncreaseConfig`, `eksResourceScalingConfig`, `route53HealthCheckConfig`, `documentDbConfig`, `rdsPromoteReadReplicaConfig`, `rdsCreateCrossRegionReadReplicaConfig`. @@ -198 +199 @@ See also: [AWS API Documentation](https://docs.aws.amazon.com/goto/WebAPI/arc-re ->>>>>>> The Amazon Web Services Region for the function to run in. +>>>>>>> The Amazon Web Services Region for the function to run in. For recovery workflows use `activatingRegion` or `deactivatingRegion` . For post-recovery workflows, use `activeRegion` (the Region with customer traffic) or `inactiveRegion` (the Region with no customer traffic). @@ -203,0 +205,2 @@ See also: [AWS API Documentation](https://docs.aws.amazon.com/goto/WebAPI/arc-re +>>>>>>> * `activeRegion` +>>>>>>> * `inactiveRegion` @@ -480 +483 @@ See also: [AWS API Documentation](https://docs.aws.amazon.com/goto/WebAPI/arc-re ->>>>>>>>> This is a Tagged Union structure. Only one of the following top level keys can be set: `customActionLambdaConfig`, `ec2AsgCapacityIncreaseConfig`, `executionApprovalConfig`, `arcRoutingControlConfig`, `globalAuroraConfig`, `parallelConfig`, `regionSwitchPlanConfig`, `ecsCapacityIncreaseConfig`, `eksResourceScalingConfig`, `route53HealthCheckConfig`, `documentDbConfig`. +>>>>>>>>> This is a Tagged Union structure. Only one of the following top level keys can be set: `customActionLambdaConfig`, `ec2AsgCapacityIncreaseConfig`, `executionApprovalConfig`, `arcRoutingControlConfig`, `globalAuroraConfig`, `parallelConfig`, `regionSwitchPlanConfig`, `ecsCapacityIncreaseConfig`, `eksResourceScalingConfig`, `route53HealthCheckConfig`, `documentDbConfig`, `rdsPromoteReadReplicaConfig`, `rdsCreateCrossRegionReadReplicaConfig`. @@ -535 +538 @@ See also: [AWS API Documentation](https://docs.aws.amazon.com/goto/WebAPI/arc-re ->>>>>>>>>>> The Amazon Web Services Region for the function to run in. +>>>>>>>>>>> The Amazon Web Services Region for the function to run in. For recovery workflows use `activatingRegion` or `deactivatingRegion` . For post-recovery workflows, use `activeRegion` (the Region with customer traffic) or `inactiveRegion` (the Region with no customer traffic). @@ -540,0 +544,2 @@ See also: [AWS API Documentation](https://docs.aws.amazon.com/goto/WebAPI/arc-re +>>>>>>>>>>> * `activeRegion` +>>>>>>>>>>> * `inactiveRegion` @@ -1213,0 +1219,96 @@ See also: [AWS API Documentation](https://docs.aws.amazon.com/goto/WebAPI/arc-re +>>>>>>>>> +>>>>>>>>> rdsPromoteReadReplicaConfig -> (structure) +>>>>>>>>> +>>>>>>>>>> An Amazon RDS promote read replica execution block. +>>>>>>>>>> +>>>>>>>>>> timeoutMinutes -> (integer) +>>>>>>>>>> +>>>>>>>>>>> The timeout value specified for the configuration. +>>>>>>>>>>> +>>>>>>>>>>> Constraints: +>>>>>>>>>>> +>>>>>>>>>>> * min: `1` +>>>>>>>>>>> + +>>>>>>>>>> +>>>>>>>>>> crossAccountRole -> (string) +>>>>>>>>>> +>>>>>>>>>>> The cross-account role for the configuration. +>>>>>>>>>>> +>>>>>>>>>>> Constraints: +>>>>>>>>>>> +>>>>>>>>>>> * pattern: `arn:aws[a-zA-Z0-9-]*:iam::[0-9]{12}:role/.+` +>>>>>>>>>>> + +>>>>>>>>>> +>>>>>>>>>> externalId -> (string) +>>>>>>>>>> +>>>>>>>>>>> The external ID (secret key) for the configuration. +>>>>>>>>>> +>>>>>>>>>> dbInstanceArnMap -> (map) [required] +>>>>>>>>>> +>>>>>>>>>>> A map of database instance ARNs for each Region in the plan. +>>>>>>>>>>> +>>>>>>>>>>> key -> (string) +>>>>>>>>>>> +>>>>>>>>>>>> Constraints: +>>>>>>>>>>>> +>>>>>>>>>>>> * pattern: `[a-z]{2}-[a-z-]+-\d+` +>>>>>>>>>>>> + +>>>>>>>>>>> +>>>>>>>>>>> value -> (string) +>>>>>>>>>>> +>>>>>>>>>>>> Constraints: +>>>>>>>>>>>> +>>>>>>>>>>>> * pattern: `arn:aws[a-zA-Z-]*:rds:[a-z0-9-]+:\d{12}:db:[a-zA-Z][a-zA-Z0-9]*(-[a-zA-Z0-9]+)*` +>>>>>>>>>>>> + +>>>>>>>>> +>>>>>>>>> rdsCreateCrossRegionReadReplicaConfig -> (structure) +>>>>>>>>> +>>>>>>>>>> An Amazon RDS create cross-Region replica execution block. +>>>>>>>>>> +>>>>>>>>>> timeoutMinutes -> (integer) +>>>>>>>>>> +>>>>>>>>>>> The timeout value specified for the configuration. +>>>>>>>>>>> +>>>>>>>>>>> Constraints: +>>>>>>>>>>> +>>>>>>>>>>> * min: `1` +>>>>>>>>>>> + +>>>>>>>>>> +>>>>>>>>>> crossAccountRole -> (string) +>>>>>>>>>> +>>>>>>>>>>> The cross-account role for the configuration. +>>>>>>>>>>> +>>>>>>>>>>> Constraints: +>>>>>>>>>>> +>>>>>>>>>>> * pattern: `arn:aws[a-zA-Z0-9-]*:iam::[0-9]{12}:role/.+` +>>>>>>>>>>> + +>>>>>>>>>> +>>>>>>>>>> externalId -> (string) +>>>>>>>>>> +>>>>>>>>>>> The external ID (secret key) for the configuration. +>>>>>>>>>> +>>>>>>>>>> dbInstanceArnMap -> (map) [required] +>>>>>>>>>> +>>>>>>>>>>> A map of database instance ARNs for each Region in the plan. +>>>>>>>>>>> +>>>>>>>>>>> key -> (string) +>>>>>>>>>>> +>>>>>>>>>>>> Constraints: +>>>>>>>>>>>> +>>>>>>>>>>>> * pattern: `[a-z]{2}-[a-z-]+-\d+` +>>>>>>>>>>>> + +>>>>>>>>>>> +>>>>>>>>>>> value -> (string) +>>>>>>>>>>> +>>>>>>>>>>>> Constraints: +>>>>>>>>>>>> +>>>>>>>>>>>> * pattern: `arn:aws[a-zA-Z-]*:rds:[a-z0-9-]+:\d{12}:db:[a-zA-Z][a-zA-Z0-9]*(-[a-zA-Z0-9]+)*` +>>>>>>>>>>>> + @@ -1231,0 +1333,2 @@ See also: [AWS API Documentation](https://docs.aws.amazon.com/goto/WebAPI/arc-re +>>>>>>>>> * `RdsPromoteReadReplica` +>>>>>>>>> * `RdsCreateCrossRegionReplica` @@ -1653,0 +1757,96 @@ See also: [AWS API Documentation](https://docs.aws.amazon.com/goto/WebAPI/arc-re +>>>>> +>>>>> rdsPromoteReadReplicaConfig -> (structure) +>>>>> +>>>>>> An Amazon RDS promote read replica execution block. +>>>>>> +>>>>>> timeoutMinutes -> (integer) +>>>>>> +>>>>>>> The timeout value specified for the configuration. +>>>>>>> +>>>>>>> Constraints: +>>>>>>> +>>>>>>> * min: `1` +>>>>>>> + +>>>>>> +>>>>>> crossAccountRole -> (string) +>>>>>> +>>>>>>> The cross-account role for the configuration. +>>>>>>> +>>>>>>> Constraints: +>>>>>>> +>>>>>>> * pattern: `arn:aws[a-zA-Z0-9-]*:iam::[0-9]{12}:role/.+` +>>>>>>> + +>>>>>> +>>>>>> externalId -> (string) +>>>>>> +>>>>>>> The external ID (secret key) for the configuration. +>>>>>> +>>>>>> dbInstanceArnMap -> (map) [required] +>>>>>> +>>>>>>> A map of database instance ARNs for each Region in the plan. +>>>>>>> +>>>>>>> key -> (string) +>>>>>>> +>>>>>>>> Constraints: +>>>>>>>> +>>>>>>>> * pattern: `[a-z]{2}-[a-z-]+-\d+` +>>>>>>>> + +>>>>>>> +>>>>>>> value -> (string) +>>>>>>> +>>>>>>>> Constraints: +>>>>>>>> +>>>>>>>> * pattern: `arn:aws[a-zA-Z-]*:rds:[a-z0-9-]+:\d{12}:db:[a-zA-Z][a-zA-Z0-9]*(-[a-zA-Z0-9]+)*` +>>>>>>>> + +>>>>> +>>>>> rdsCreateCrossRegionReadReplicaConfig -> (structure) +>>>>> +>>>>>> An Amazon RDS create cross-Region replica execution block. +>>>>>> +>>>>>> timeoutMinutes -> (integer) +>>>>>> +>>>>>>> The timeout value specified for the configuration. +>>>>>>> +>>>>>>> Constraints: +>>>>>>> +>>>>>>> * min: `1` +>>>>>>> + +>>>>>> +>>>>>> crossAccountRole -> (string) +>>>>>> +>>>>>>> The cross-account role for the configuration. +>>>>>>> +>>>>>>> Constraints: +>>>>>>> +>>>>>>> * pattern: `arn:aws[a-zA-Z0-9-]*:iam::[0-9]{12}:role/.+` +>>>>>>> +